How to Find Subdomains of a Website with Amass (Own Scope)
To discover subdomains for a domain in your written scope, install Amass and run a passive enum: amass enum -passive -d example.com -o subs.txt. Passive mode uses public sources and does not flood the target. Always stay inside permission.
Quick answer
sudo apt install -y amass # Kali / Debian
amass enum -passive -d example.com -o subs.txt
wc -l subs.txt; head subs.txtWhy find subdomains?
Attackers map dev, staging, old-vpn before they touch the main site. Defenders must find those names first. Elena in Madrid and Arjun in Surat both keep a living subdomain list for their own companies.
What does Amass do?
Amass gathers names from public sources (certificates, DNS datasets, search data depending on config). Passive mode avoids loud guesses against the target.
How do I run it step by step?
- Write the domain you own, for example
oleole.in(sample). - Install (Kali example):
sudo apt update && sudo apt install -y amass amass -versionWhat it means: Confirms Amass is installed.
- Passive enumeration:
amass enum -passive -d example.com -o subs.txt head -20 subs.txtwww.example.com mail.example.com dev.example.com cdn.example.comWhat it means: Four names found from public sources. Investigate dev.example.com if you did not expect it.
- Sort and diff next week:
sort -u subs.txt > subs-sorted.txt comm -13 last-week.txt subs-sorted.txtWhat it means: Shows names that appeared since last week.
- For each new name: who owns it, is HTTPS on, is it still needed?
Do not run aggressive brute force against third-party domains.
Ravindra Bagale's Tip
Passive first. Active brute force can look like an attack in SOC dashboards. For Sahyadri Traders' own domain, Neha in Pune runs passive Amass weekly and diffs the list for surprise hostnames.
Ravindra Bagale's Tip – मराठी
आधी passive. Active brute force SOC डॅशबोर्डला हल्ला वाटू शकते. सह्याद्री ट्रेडर्सच्या स्वतःच्या domain साठी पुण्यातील नेहा साप्ताहिक passive Amass चालवते आणि नवे hostname शोधते.
Ravindra Bagale's Tip – हिंदी
पहले passive। Active brute force SOC डैशबोर्ड को हमला लग सकता है। सह्याद्री ट्रेडर्स के अपने domain के लिए पुणे की नेहा साप्ताहिक passive Amass चलाती है और नए hostname ढूँढती है।
Quick quiz: check what you learned
Which Amass flag keeps discovery passive (no active probing)?
- -passive for DNS-only discovery
- -brute-all on production hosts
- -exploit to attack live hosts
- -T5 for maximum nmap speed
Show answer
A. -passive uses public sources only.
Before enumerating subdomains of a company site, you should:
- Have written authorisation for that domain
- Scan every random .com you can find
- Post results on a public forum first
- Disable logging on your laptop
Show answer
A. Only enumerate domains you own or have permission for.
Learn it properly
This guide is the short path. These pages go deeper, with labs:
Frequently asked questions
What tool finds subdomains?
Amass is a common choice. Subfinder and Certificate Transparency logs help too.
Is passive Amass safe?
Safer than active brute force because it queries public data, not the target heavily. Still need permission for your engagement rules.
Why do subdomains matter for security?
Forgotten apps (dev, old-jira, vpn2) often miss patches and become entry points.
Can I scan any company domain?
No. Only with authorisation. Random scanning can be illegal.
Related course lesson?
Cyber 36.2 Amass subdomain discovery.